5548 matches found
Digital Bazaar Forge 数据伪造问题漏洞
Digital Bazaar Forge is a native implementation of Tls in Javascript and an open source tool for writing encryption-based and network-intensive Web applications from Digital Bazaar, Inc. A data forgery issue vulnerability exists in versions prior to Digital Bazaar Forge 1.3.0, which originated in...
CLSA-2022-1647550273 Fix of CVE: CVE-2022-0778
CVE-2022-0778: Fix possible infinite loop in BNmodsqrt...
Fujifilm / Fuji Xerox Printers Cryptography Vulnerability (Mar 2022)
Multiple Fujifilm / Fuji Xerox printers are prone to a cryptography vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if descripti...
CVE-2022-0778 Infinite loop in BN_mod_sqrt() reachable when parsing certificates
The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a...
PT-2022-6958
Name of the Vulnerable Software and Affected Versions golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go golang.org/x/crypto/ssh versions through 1.16.15 golang.org/x/crypto/ssh versions 1.17.x through 1.17.8 Description The issue is related to the use of defective...
Mustang Panda targets European diplomats using enhanced PlugX backdoor
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here Mustang Panda, a Chinese cyberespionage group, has been targeting European diplomats with a revised version of the PlugX backdoor in an ongoing campaign linked to the ongoing conflict in Ukraine. The group, also known as...
Vulnerability fixed in PAN-OS
A vulnerability has been fixed in PAN-OS. The vulnerability with reference CVE-2022-0022 allows a malicious person with access to the system's password hashes, to crack the hashes to crack and thus gain access to the passwords. This vulnerability arose because PAN-OS uses a weak cryptographic...
SUSE: Security Advisory (SUSE-SU-2022:0757-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Chaya - Advance Image Steganography
Chaya protects your privacy through steganography, cryptography and compression. It effectively encrypts your payloads using AES-256-GCM cryptography, embeds them using LSB-LPS steganography technique into images and compresses them using FLIF to evade detection by performing lossless compression...
Decrypting Hive Ransomware Data
Nice piece of research: Abstract: Among the many types of malicious codes, ransomware poses a major threat. Ransomware encrypts data and demands a ransom in exchange for decryption. As data recovery is impossible if the encryption key is not obtained, some companies suffer from considerable damag...
Cryptographer – Job Description and How to Become
Introduction Cryptography is perhaps the main instrument for building a secure computerized framework. These professionals assume a major part in building these frameworks. This makes them probably the most generously compensated and profoundly esteemed laborers inside the growing universe of...
Intel® IPP Cryptography Advisory
Summary: A potential security vulnerability in the Intel® Integrated Performance Primitives IPP Cryptography software library may allow information disclosure. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2021-33147 Description:...
Weak Cryptography
github.com/gravitl/netmaker is vulnerable to weak cryptography. The vulnerability exits in SetJWTSecret function of wts.go due to hard-coded secret key which allows an attacker to create a valid authentication token for any user and use it with admin privileges...
Zabbix - A Case Study of Unsafe Session Storage
Introduction Zabbix is a very popular open-source monitoring platform used to collect, centralize and track metrics like CPU load and network traffic across entire infrastructures. It is very similar to solutions like Pandora FMS and Nagios. Because of its popularity, features and its privileged...
Insecure Cryptography
github.com/aws/aws-sdk-go is vulnerable to insecure cryptography. The vulnerability exists due to broken encryption algorithm which allows an attacker with write access to change AES-GCM to AES-CTR...
EulerOS Virtualization 3.0.6.0 : nettle (EulerOS-SA-2022-1084)
According to the versions of the nettle packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions GOST DSA, EDDSA & ECDS...
Huawei EulerOS: Security Advisory for nettle (EulerOS-SA-2022-1084)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
In-band key negotiation issue in AWS S3 Crypto SDK for golang
Summary The golang AWS S3 Crypto SDK is impacted by an issue that can result in loss of confidentiality and message forgery. The attack requires write access to the bucket in question, and that the attacker has access to an endpoint that reveals decryption failures without revealing the plaintext...
AZL-79100 CVE-2022-23806 affecting package golang 1.25.7-1
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element...
